Parameters annotated with Spring's @RequestBody and @PathVariable are remote input sources.

2026-04-25 08:45:14 +02:00 · 2019-04-17 18:02:00 -04:00
parent c674f54129
commit 2f200d7517
1 changed files with 3 additions and 1 deletions
--- a/java/ql/src/semmle/code/java/frameworks/SpringWeb.qll
+++ b/java/ql/src/semmle/code/java/frameworks/SpringWeb.qll
@@ -11,7 +11,9 @@ class SpringServletInputAnnotation extends Annotation {
      a.hasName("RequestParam") or
      a.hasName("RequestHeader") or
      a.hasName("CookieValue") or
-      a.hasName("RequestPart")
+      a.hasName("RequestPart") or
+      a.hasName("PathVariable") or
+      a.hasName("RequestBody")
    )
  }
 }